# What is IT support? Scope, service models and what a small business needs

> IT support keeps a business's devices, accounts, email, network and data working and secure. What it covers, how it is delivered and which model fits.

- URL: https://computese.com/understanding-it-support-a-vital-role-in-the-digital-era/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2023-12-01
- Updated: 2026-09-25
- Topics: IT support

## In short
- IT support is the service that keeps a business's technology usable and safe: it fixes what breaks, handles requests such as new accounts, and does the routine work (updates, backups, monitoring, records) that stops problems coming back.
- The scope is wider than the help desk: devices, accounts and MFA, Microsoft 365 or Google Workspace, the network and Wi-Fi, printers, backups, starters and leavers, and the vendors behind them.
- It is staffed in-house, by a managed service provider, or co-managed between the two. Whichever you choose, the admin accounts, the records and the accountability should stay with the business.
- A service level agreement makes support checkable: what is covered, in which hours, how fast a person responds to each priority, and who does what in a security incident.
- Need grows with size: in the UK government's 2025/2026 breaches survey, 42% of micro businesses and 65% of medium ones identified a cyber breach or attack in the previous 12 months.

IT support is the service that keeps a business's technology working and safe to use. It fixes what breaks, handles everyday requests such as a new starter's account, and does the routine work that stops problems coming back: updates, backups, monitoring and records. It covers devices, accounts, email and files, the network, and the vendors behind them.

This guide sets out what IT support covers for a small or growing business, the security basics it should never skip, how it is delivered, the three ways to staff it (in-house, a managed service provider or co-managed), what a service level agreement should say, and how to judge the level of support you need. If you are already weighing up outsourcing, the [help desk outsourcing guide](https://computese.com/unlocking-the-power-of-it-helpdesk-outsourcing-top-5-benefits-and-best-practices/) covers the business case, pricing and choosing a provider. How a help desk works inside, from support tiers to tickets and metrics, is covered in [what an IT help desk is](https://computese.com/demystifying-the-it-help-desk-navigating-the-world-of-outsourced-support/), and the job itself, from duties to pay, in [what an IT support specialist does](https://computese.com/unlocking-the-role-of-an-it-support-specialist/).

## What IT support means for a business

"IT support" is used loosely, and offers are hard to compare until you split it into the three kinds of work it contains:

| Kind of work     | What it means                                                | Examples                                                                 |
| ---------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------ |
| Incidents        | Something stopped working or got worse; restore service fast | Outlook will not open, the Wi-Fi keeps dropping, a laptop will not start |
| Service requests | A routine, predefined ask, handled the same way every time   | A new starter's account, access to a shared mailbox, a software install  |
| Preventive work  | The routine that makes the first two rarer                   | Updates, monitoring, backup checks, access reviews, fixing repeat faults |

The ITIL 4 framework treats these as separate practices. [Incident management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-incident-management-3684) restores normal service quickly after a disruption. [Service request management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-service-request-management-3690) handles predefined, user-initiated requests for a service, information or access. [Problem management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-problem-management-3688) finds the root causes of incidents so they stop recurring.

Break-fix support covers only the first row: you call when something breaks and pay by the hour or by the job. Everything that makes the next incident less likely sits in the third row, which is why two quotes for "IT support" can describe very different services. Two related terms: the help desk (or service desk) is the front door where people report problems and ask for things, and managed IT services means an outside provider takes the whole job on under a contract.

## What IT support covers

For a business of up to a few hundred people, the scope usually looks like this. Read it as a checklist: an area nobody owns is a gap.

| Area                              | What support does                                                                                          |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| Devices                           | Sets up laptops, desktops, phones and tablets; enrols, encrypts and updates them; repairs and retires them |
| Accounts and identity             | One account per person, multi-factor authentication (MFA), password resets, admin rights, single sign-on   |
| Microsoft 365 or Google Workspace | Mailboxes, shared drives, licences, sharing settings, retention and mail authentication                    |
| Network and Wi-Fi                 | Router and firewall, staff and guest Wi-Fi, remote access, and the internet provider when the line fails   |
| Printers and peripherals          | Printers and scanners, docking stations, monitors, headsets, meeting-room equipment                        |
| Business applications             | First-line help and access for accounting, CRM or line-of-business software, and escalation to its vendor  |
| Security basics                   | Updates, MFA, malware protection, backups and least-privilege access (next section)                        |
| Starters and leavers              | Accounts, devices and access ready before day one, and removed on the last day                             |
| Vendors and records               | Internet, phone and software vendors, warranties, licences and an asset register                           |

### Devices, from set-up to retirement

Device work follows a lifecycle: buy, enrol, configure, update, repair, retire. Enrolling a laptop or phone in a mobile device management (MDM) platform such as Microsoft Intune, Jamf or Google endpoint management lets support push settings, require encryption, install updates and lock or wipe a lost device without touching it. [Microsoft 365 Business Premium](https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-overview), designed for businesses with up to 300 users, includes device management for Windows, Mac, iOS and Android.

Retirement is where lifecycles slip. [Windows 10 reached end of support](https://learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro) on October 14, 2025, and as of September 2026 Microsoft lists [Extended Security Updates](https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates) for organizations at US$61 per device for the first year, doubling each year, for three years at most. Support tracks which devices are approaching end of support so their replacement is a budget line rather than a surprise. For a single new PC, see [how to set up Windows 11 on a new computer](https://computese.com/how-to-set-up-windows-for-a-new-computer/).

### Accounts, identity, and Microsoft 365 or Google Workspace

For most small businesses, the identity system is the Microsoft 365 or Google Workspace tenant: one account opens email, files and chat and, through single sign-on, other business apps. That makes it the most valuable thing support looks after, and the first to lock down.

- In Microsoft Entra ID, [security defaults](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults) switch on a preset baseline at no extra cost: every user registers for MFA, administrators must use it, and legacy authentication protocols are blocked. Microsoft points organizations with Entra ID P1 or P2 licences to Conditional Access policies instead.
- In Google Workspace, an administrator rolls out [2-Step Verification](https://support.google.com/a/answer/9176657?hl=en) and can then enforce it; Google itself is enforcing it for administrator accounts.
- Mail authentication records (SPF, DKIM and DMARC) make your domain harder to spoof, and sharing policies decide whether files can go to anyone with a link.

As of September 2026, both platforms cap their business plans at 300 users: Microsoft 365 Business Premium is designed for up to 300, and [Google Workspace](https://workspace.google.com/pricing?hl=en) Business Starter, Standard and Plus can be bought for at most 300. Past that, enterprise plans apply, and the support work grows with them.

### Networks, Wi-Fi, printers and the office

The office network is usually a router and firewall, a Wi-Fi system and a switch. Support keeps their firmware current, keeps guest Wi-Fi apart from staff devices, and applies the firewall rules in the UK's [Cyber Essentials requirements](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf): change the default admin password, keep the admin interface off the internet unless there is a documented need and it is protected by MFA or an IP allow list, and block unauthenticated inbound connections by default. When the line fails, support calls the internet provider with the tests already done.

Printers, docks, monitors and headsets produce a steady trickle of small tickets, and they mark where remote support stops: a jammed printer or a dead dock needs hands on site, or a replacement shipped.

### Starters, leavers and vendors

Onboarding and offboarding are where IT support meets HR, and where small businesses leak access. A checklist per role covers the account, licences, groups, device, MFA enrolment and app access for a starter, and the reverse for a leaver: disable the account, sign out its sessions, recover or wipe the device, hand over files and mail, remove admin rights. Cyber Essentials requires accounts to be removed or disabled when they are no longer needed, for example when someone leaves, and [CISA's guidance for small businesses](https://www.cisa.gov/cyber-guidance-small-businesses) notes that MFA gaps tend to appear among recently onboarded staff and people who have moved to a new phone. When apps sign in through the Microsoft 365 or Google account, disabling that one account closes most doors at once; every app with its own password needs its own step.

![An account card in the centre links by thin lines to a laptop, a phone, a mailbox, a cloud folder and an app window. An orange switch beside the card is off, and every line is broken.](https://computese.com/images/blog/understanding-it-support-a-vital-role-in-the-digital-era/leaver.9377af0c13-1536.webp)

*Single sign-on turns offboarding into one switch; every separate password is a door someone has to remember.*

Vendor coordination is the other half. Support keeps the list of who supplies what (internet line, phones, printers, line-of-business software, hardware warranties), holds the contract numbers and support contacts, and deals with those vendors so staff do not have to. ITIL's [IT asset management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-4-practitioner-it-asset-management-3792) practice covers the same ground: every asset managed through purchase, use and disposal to control cost and risk.

## The security basics every support arrangement should include

Government baselines for small organizations agree on a short list, and it belongs inside IT support rather than in a separate project. The same habits from each user's side, from passkeys to spotting phishing, are in our [cyber security tips](https://computese.com/cyber-it-security/). The UK's [Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview) scheme, which the government recommends as the minimum standard for organizations of all sizes, rests on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Canada's [baseline cyber security controls](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations), written for organizations with fewer than 500 employees, and CISA's guidance for small businesses cover the same ground and add backups and a written incident response plan.

| Basic                  | What it means in practice                                                                                                    |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| Security updates       | Automatic updates on; fixes for critical or high-risk vulnerabilities installed within 14 days; unsupported software removed |
| MFA                    | Enforced by policy rather than left to each user; always on for cloud services and administrator accounts                    |
| Admin rights           | Removed from everyday laptops; separate admin accounts used only for admin work                                              |
| Malware and encryption | Built-in malware protection and firewall active on every device; disk encryption on every laptop                             |
| Backups                | Essential data backed up automatically, one copy kept apart, restores tested                                                 |
| Account removal        | Accounts and special privileges removed when someone leaves or changes role                                                  |

The 14-day rule and MFA on every cloud service come from Cyber Essentials v3.3, published in April 2026. CISA adds an order of work: fix what is in its Known Exploited Vulnerabilities (KEV) Catalog first, because attackers are using those flaws in real attacks. It also tells IT teams to enforce MFA with technical controls rather than trust everyone to enrol, and to take admin rights off user laptops, so that a user tricked into running malicious software cannot install it.

MFA is the gap most often left open. In the UK government's [Cyber security breaches survey 2025/2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), 74% of businesses backed up data to a cloud service and 73% restricted admin rights, but only 47% had two-factor authentication in place.

Copying files to the cloud is a start, but a backup needs two more properties. One copy has to be out of reach of whatever encrypts or deletes the originals: the NCSC advises keeping an external backup drive [disconnected when it is not in use](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data), and Canada's baseline asks for long-term backups to be stored offline. And it has to restore: CISA notes that many ransomware victims had no backups or incomplete ones, and calls regular partial and full restore tests critical.

![A laptop and a small server copy documents to a cloud and to an orange external drive that sits unplugged, apart from them. A curved arrow brings one document back from the drive to the laptop.](https://computese.com/images/blog/understanding-it-support-a-vital-role-in-the-digital-era/backup.cf2eb69f36-1536.webp)

*A backup counts once it is out of an attacker's reach and you have restored something from it.*

> [!IMPORTANT]
> Ask whoever supports you when a file was last restored from backup as a test, and from which copy. A backup job that reports success has not yet proved anything.

## How IT support is delivered

Support reaches people in four ways, and a sound arrangement uses all of them:

| Channel                              | Best for                                                                                    | Limits                                                                        |
| ------------------------------------ | ------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| Help desk                            | Reporting problems and asking for things by phone, email, portal or chat, logged as tickets | Only as good as its records and the people behind it                          |
| Remote support                       | Account, email, software and settings problems, fixed on the user's screen with consent     | Cannot fix hardware, cabling or a device that will not connect                |
| On-site support                      | Hardware faults, network and Wi-Fi work, printers, office moves and new desks               | Slower and dearer; check whether visits are included, billed or subcontracted |
| Proactive monitoring and maintenance | Updates, disk space, backup results and security alerts watched by software                 | Needs an agent on every device and someone who acts on the alerts             |

For a small business, the help desk mostly needs to be one channel people actually use, with a ticket for every request so nothing depends on memory. The tools behind remote support (remote access, RMM, ticketing, device management and documentation) are compared in the [remote IT support tools guide](https://computese.com/top-10-essential-tools-for-remote-it-support/), and supporting people who work from home or across time zones is covered in the [guide to help desk support for remote teams](https://computese.com/optimizing-remote-work-through-outsourced-it-help-desk-support/).

Proactive monitoring is what separates support from repair. Remote monitoring and management (RMM) agents on each device report health and patch status, run scheduled maintenance and raise an alert when a disk fills, a backup fails or security software flags something, so the ticket exists before anyone calls. ITIL treats this as its own practice, [monitoring and event management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-monitoring-and-event-management-3686), which detects events early to keep services stable. In the qualitative interviews of the UK breaches survey, organizations with small teams named their provider's ability to monitor and act outside working hours as a significant advantage.

![A desk phone, an envelope and a laptop send cards into one queue of grey tickets. Below, a server and a laptop with monitoring agents send an orange alert card into the front of the same queue.](https://computese.com/images/blog/understanding-it-support-a-vital-role-in-the-digital-era/queue.928658fa66-1536.webp)

*When monitoring raises the ticket, the first sign of a failing backup is not the person who needed the file.*

Projects such as a Microsoft 365 migration, an office move or a laptop refresh are related but different work. Check whether an agreement includes them or quotes them separately, so the monthly fee means what you think it means.

## In-house, managed service provider or co-managed

Who does the work is a separate decision from what the work is. There are three models, and businesses often move between them as they grow.

### In-house

Your own employees provide support. They know the business, the people and the quirks of your systems, and they are on site. The limits are breadth and cover: one or two people cannot be experts in identity, networking, security and every application, and nobody covers their holidays or nights unless you pay for it. The quiet risk is one person who holds every password and the whole picture in their head.

### Managed service provider (MSP)

A provider delivers, operates or manages your IT under a contract, usually with a service level agreement. You get a wider bench of skills, tools you would not buy for yourself, and cover outside office hours if the contract includes it. What you give up is context: the provider learns your business from documentation, so the documentation has to exist.

An MSP also holds privileged access. A joint advisory from the cybersecurity agencies of the US, UK, Canada, Australia and New Zealand on [threats to managed service providers](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a) warns that a vulnerable provider can be a way into many customer networks, and says contracts should require MFA on every MSP account used to access a customer's environment. Cyber Essentials counts accounts used by an MSP as part of your own scope, and expects you to be able to confirm that externally managed services meet its controls.

### Co-managed

An internal IT person or team keeps ownership of systems, priorities and decisions, and a provider takes defined work: first-line tickets, after-hours cover, overflow, monitoring or projects. It combines context with breadth, and fails in one predictable way: tickets and systems nobody is sure they own. It works when every type of work has a named owner and both teams use the same queue and records.

### What stays with the business

Break-fix, calling a technician only when something breaks, is what you have when nobody has chosen a model. It can be cheap in a quiet year, but nobody is paid to patch, check backups or remove a leaver's access.

Whichever model you choose, some things stay with you. CISA's small business guidance says security culture cannot be delegated and warns against treating security as the IT team's job alone; it asks the chief executive to back MFA in person, and to name someone, who need not be technical, to run the security program. In practice, keep an administrator account in the business's own name, own the documentation and the asset register, and approve who holds admin rights.

## What a service level agreement covers

A service level agreement (SLA) is the written version of what support covers and how well. ITIL's [service level management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-4-practitioner-service-level-management-3867) practice sets clear, business-based targets for utility, warranty and experience: roughly, whether the service does what the business needs, whether it is dependable enough, and what using it is like. For IT support, an SLA should state:

1. **Scope.** The people, devices, sites and applications covered, and what is excluded.
2. **Hours and channels.** Service hours with the time zone and holidays, any after-hours cover, and how to raise a request.
3. **Priorities.** How impact and urgency set a priority, with examples from your own business.
4. **Targets for each priority.** Time to a first response from a person, and time to a fix or workaround, in business or calendar hours.
5. **Escalation.** Whom to call when a target is missed or a problem is bigger than a ticket.
6. **Security responsibilities.** Who patches, how admin access is granted and removed, and who tells whom about a security incident, how fast.
7. **Reporting and review.** What the regular report shows and who meets to discuss it.
8. **Exit.** What is handed back (admin accounts, documentation, data) when the agreement ends.

Response and resolution are different clocks. Response is a person acknowledging the request and starting work; an automatic "we got your email" should not count. Resolution is the service working again, or a workaround in place. A typical priority scheme:

| Priority | Meaning                   | Example                                                   |
| -------- | ------------------------- | --------------------------------------------------------- |
| P1       | The business has stopped  | Nobody can send email, or the office network is down      |
| P2       | A team is blocked         | Accounts cannot reach the finance system before a pay run |
| P3       | One person is slowed down | One laptop's docking station stopped working              |
| P4       | A request or question     | Set up a starter who joins next month                     |

As a reference point, the default targets for a first reply from an engineer in our [IT support agreement](https://computese.com/services/it-support/) are 1 hour for P1, 4 hours for P2, 8 business hours for P3 and 24 hours for P4, and an agreement can tighten them. How to write targets that measure outcomes rather than speed alone is covered in the [outsourcing guide](https://computese.com/unlocking-the-power-of-it-helpdesk-outsourcing-top-5-benefits-and-best-practices/).

## How much IT support does your business need?

There is no staffing ratio that fits every business, but the need grows with size, and so does the exposure. The UK government's Cyber security breaches survey 2025/2026, published on April 30, 2026, found that 43% of businesses had identified a cyber breach or attack in the previous 12 months: 42% of micro businesses (1 to 9 employees), 46% of small ones (10 to 49), 65% of medium ones (50 to 249) and 69% of large ones (250 or more). Formal incident response plans follow the same curve: 21% of micro businesses had one, against 57% of medium and 76% of large businesses.

Use the survey's size bands as a starting point, not a rule:

| Size         | Typical set-up                                                                | Have in place at minimum                                                                    |
| ------------ | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| 1 to 9 staff | No IT staff: one named owner, plus a provider on call or a small managed plan | MFA enforced, automatic updates, tested backups, a list of devices and accounts             |
| 10 to 49     | A managed service provider, or one IT generalist with a provider behind them  | Device management, starter and leaver checklists, an asset register, a written SLA          |
| 50 to 249    | An internal IT lead working with a provider (co-managed), or a small team     | Access reviews, a change log, an incident response plan, after-hours cover where it matters |
| 250 or more  | An IT team, with specialist providers for security, networks or projects      | Enterprise licensing beyond the 300-user business plans, formal service management          |

Size is only the first input. Move up a row if any of these apply:

- more than one site, or staff working remotely across time zones;
- regulated or sensitive data, such as health records, card payments or client money;
- work that runs outside office hours, such as shifts, online sales or clients abroad;
- a line-of-business system the business cannot run without;
- a high cost for each hour of downtime.

Then look at the symptoms. You have outgrown your current support if new hires wait days for a working laptop, former staff might still have access, passwords live in a spreadsheet, the same fault comes back every month, or nobody can say who holds admin rights.

## Where to start if nobody owns IT today

If support has so far meant whoever knows most about computers, this order closes the biggest gaps first and produces what any provider will ask for:

1. **Name an owner:** one person accountable for IT decisions. CISA is explicit that this person need not be technical.
2. **Write down what you have:** devices, accounts, licences, vendors and who has admin rights. Every later step, and any quote, starts from this list.
3. **Secure the admin accounts:** separate, used only for admin work, protected by MFA. Remove any that belong to former staff or to nobody.
4. **Enforce MFA for everyone** with security defaults in Microsoft Entra ID or enforced 2-Step Verification in Google Workspace, then find who has not enrolled.
5. **Turn on automatic updates**, and list what no longer receives them, such as Windows 10 without Extended Security Updates.
6. **Test a restore** from your backups, and keep one copy apart from the network.
7. **Write starter and leaver checklists**, so access is granted and removed the same way every time.
8. **Choose a model** (in-house, managed or co-managed) and put the scope and targets in writing.

If you would rather hand this over, our [IT support service](https://computese.com/services/it-support/) works either as your help desk and administrators or alongside your own IT team, and starts with an IT environment assessment: an inventory of devices, accounts and licences, who has admin access and who should not, security gaps ranked across MFA, patching, backups and mail, and a support plan with a quote. More guides for running IT in a small team are in the [IT support topic](https://computese.com/category/it-support/).

## Key terms
- **IT support**: The people, tools and routines that keep a business's devices, accounts, applications and network working, from fixing faults and handling requests to applying updates and setting up new staff.
- **Incident and service request**: An incident is something that stopped working or got worse, where the goal is to restore service. A service request is a routine, predefined ask, such as a new account or access to a shared mailbox.
- **Break-fix support**: Paying for IT help only when something breaks, by the hour or by the job, with no routine maintenance, monitoring or records included.
- **Managed service provider (MSP)**: A company that delivers, operates or manages IT services for its customers under a contract, usually with a service level agreement.
- **Co-managed IT**: An internal IT person or team and an outside provider sharing the work under agreed rules, with every type of work given a named owner.
- **Service level agreement (SLA)**: The written agreement on what a support service covers, in which hours and to which targets, such as the time to a first response from a person for each priority.
- **Mobile device management (MDM)**: Enrolling laptops and phones in a console, such as Microsoft Intune or Jamf, that applies settings, encryption and updates, and can lock or wipe a lost device remotely.
- **RMM (remote monitoring and management)**: Software agents on each device that report health and patch status, run scheduled maintenance and raise alerts, so problems can be fixed before users notice them.
- **Multi-factor authentication (MFA)**: Sign-in that needs something besides a password, such as an authenticator app prompt, a passkey or a security key. Google calls it 2-Step Verification.

## Common questions

### What is IT support in simple terms?

IT support is the help a business gets to keep its technology working: fixing problems, setting up people and devices, and keeping systems updated and backed up. It can come from your own staff, from an outside provider or from both.

### What does IT support do for a small business?

It sets up and manages laptops and phones, runs accounts and MFA in Microsoft 365 or Google Workspace, keeps the network and printers working, applies updates, checks backups, sets up starters and removes leavers, and deals with vendors such as the internet provider. Good support also writes down what it manages, so the knowledge belongs to the business.

### What is the difference between break-fix and managed IT support?

Break-fix means calling someone when something breaks and paying by the hour or by the job. Managed support is a recurring service that also covers the preventive work (monitoring, patching, backup checks, access reviews and records) with response targets in an agreement. Break-fix can cost less in a quiet year, but nobody is paid to prevent the next problem.

### Is remote IT support enough, or do we need someone on site?

Account, email, software and settings problems can usually be fixed remotely. Hardware faults, network and Wi-Fi work, printers, office moves and devices that cannot connect still need someone on site, so check whether visits are included, billed per visit or subcontracted.

### Do we still need someone in-house if we use a managed service provider?

Yes: one named person, who does not have to be technical. They approve access and spending, set priorities and own the admin accounts and records with the provider. CISA's guidance for small businesses says security culture cannot be delegated, and Cyber Essentials expects you to confirm that externally managed services meet its controls.

### When does a business need its own IT staff?

There is no fixed headcount. The need grows with people, sites and systems, with sensitive or regulated data, and with what an hour of downtime costs. Past a few dozen staff, consider an internal IT lead who works with a provider (co-managed support).

## Sources
1. [ITIL 4 Practitioner: Incident Management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-incident-management-3684), PeopleCert
2. [ITIL 4 Practitioner: Service Request Management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-service-request-management-3690), PeopleCert
3. [ITIL 4 Practitioner: Problem Management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-problem-management-3688), PeopleCert
4. [Microsoft 365 Business Premium overview](https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-overview), Microsoft Learn
5. [Windows 10 Home and Pro: lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro), Microsoft Learn
6. [Extended Security Updates (ESU) program for Windows 10](https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates), Microsoft Learn
7. [Security defaults in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults), Microsoft Learn
8. [Deploy 2-Step Verification](https://support.google.com/a/answer/9176657?hl=en), Google Workspace Admin Help
9. [Google Workspace plans and pricing](https://workspace.google.com/pricing?hl=en), Google
10. [Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026)](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf), National Cyber Security Centre (UK)
11. [CISA Cyber Guidance for Small Businesses](https://www.cisa.gov/cyber-guidance-small-businesses), CISA
12. [ITIL 4 Practitioner: IT Asset Management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-4-practitioner-it-asset-management-3792), PeopleCert
13. [Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), National Cyber Security Centre (UK)
14. [Baseline cyber security controls for small and medium organizations](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations), Canadian Centre for Cyber Security
15. [Cyber security breaches survey 2025/2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), UK Department for Science, Innovation and Technology
16. [Small organisations guide to cyber security: Backing up your data](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/backing-up-your-data), National Cyber Security Centre (UK)
17. [ITIL 4 Practitioner: Monitoring and Event Management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil4-practices-monitoring-and-event-management-3686), PeopleCert
18. [Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a), CISA
19. [ITIL 4 Practitioner: Service Level Management](https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-4-practitioner-service-level-management-3867), PeopleCert